Cisco Cisco Web Security Appliance S360 User Guide

It must include a matching private key in PEM format. DER format is not 
supported.

The private key must be unencrypted.

The Web Security appliance cannot generate Certificate Signing Requests (CSR). 
Therefore, to have a certificate created for the appliance, you must issue the 
signing request from another system. Save the PEM-formatted key from this 
system because you will need to install it on the appliance later.

You can use any UNIX machine with a recent version of OpenSSL installed. Be 
sure to put the appliance hostname in the CSR. Use the guidelines at the following 
location for information on generating a CSR using OpenSSL: 

http://www.modssl.org/docs/2.8/ssl_faq.html#ToC28

 

Once the CSR has been generated, submit it to a certificate authority (CA). The 
CA will return the certificate in PEM format.

If you are acquiring a certificate for the first time, search the Internet for 
“certificate authority services SSL server certificates,” and choose the service that 
best meets the needs of your organization. Follow the service’s instructions for 
obtaining an SSL certificate.

You can also generate and sign your own certificate. Tools for doing this are 
included with OpenSSL, free software from 

http://www.openssl.org

.

In addition to root certificate authority (CA) certificate verification, AsyncOS 
supports the use of intermediate certificate verification. Intermediate certificates 
are certificates issued by a trusted root CA which are then used to create 
additional certificates. This creates a chained line of trust. For example, a 
certificate may be issued by example.com who, in turn, is granted the rights to 
issue certificates by a trusted root CA. The certificate issued by example.com 
must be validated against example.com’s private key as well as the trusted root 
CA’s private key.